Method and apparatus for enhanced distribution of security keys

An apparatus for updating security keys in a group of policy enforcement points (PEPs) comprising:

• a key server;
• and
• at least one processor operatively coupled to the key server and configured to:
• provide a new decryption key to each PEP, and cause each PEP to support decryption using the new decryption key while still supporting decryption using an old decryption key previously installed in each PEP;
• wait until receipt of a first acknowledgement from each and every PEP in the group of PEPs, the first acknowledgement indicating that each PEP has installed and is supporting the new decryption key, and upon receipt of all the first acknowledgements, provide a new encryption key, corresponding to the new decryption key, to each PEP of the PEP group, and cause each PEP to support encryption using the new encryption key and halt support of encryption using a previously-installed old encryption key that corresponds to the old decryption key;
• and
• wait until receipt of a second acknowledgement from each and every PEP in the group of PEPs, the second acknowledgement indicating that each PEP has installed and is supporting the new encryption key, and has halted support of encryption using the old encryption key, and upon receipt of all the first acknowledgements, cause each PEP to (i) halt support of the old decryption key and (ii) remove any decryption keys older than the new decryption key and (iii) remove any encryption keys older than the new encryption key.

A computer program product updating security keys in a plurality of policy enforcement points (PEPs), comprising:

• a non-transitory computer-readable medium storing computer software instructions, and
• the computer software instructions when executed by a processor cause a computer system to:
• providing a new decryption key to each PEP, and causing each PEP to support decryption using the new decryption key while still supporting decryption using an old decryption key previously installed in each PEP;
• waiting until receipt of a first acknowledgement from each and every PEP in the group of PEPs, the first acknowledgement indicating that each PEP has installed and is supporting the new decryption key, and upon receipt of all the first acknowledgements, providing a new encryption key, corresponding to the new decryption key, to each PEP of the PEP group, and causing each PEP to support encryption using the new encryption key and halt support of encryption using a previously-installed old encryption key that corresponds to the old decryption key;
• and
• waiting until receipt of a second acknowledgement from each and every PEP in the group of PEPs, the second acknowledgement indicating that each PEP has installed and is supporting the new encryption key, and has halted support of encryption using the old encryption key, and upon receipt of all the second acknowledgements, causing each PEP to (i) halt support of the old decryption key and (ii) remove any decryption keys older than the new decryption key and (iii) remove any encryption keys older than the new encryption key.